CVE-2025-62241
BaseFortify
Publication date: 2025-10-13
Last updated on: 2025-11-12
Assigner: Liferay Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| liferay | digital_experience_platform | 2023.q4.1 |
| liferay | digital_experience_platform | 2023.q4.2 |
| liferay | digital_experience_platform | 2023.q4.3 |
| liferay | digital_experience_platform | 2023.q4.4 |
| liferay | digital_experience_platform | 2023.q4.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-62241 is an Insecure Direct Object Reference (IDOR) vulnerability in Liferay DXP versions 2023.Q4.1 through 2023.Q4.5. It allows remote authenticated users to view shipment addresses from different virtual instances by manipulating the parameter `_com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId`. This happens because the system does not properly restrict access between virtual instances, enabling unauthorized access to shipment address data. [1]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of shipment address information across different virtual instances. Remote authenticated users could access sensitive shipment address data that they should not have permission to view, potentially leading to privacy breaches or misuse of personal information. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing whether an authenticated user can access shipment addresses from different virtual instances by manipulating the parameter `_com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId` in requests to the Liferay Commerce Order Portlet. You can use tools like curl or Burp Suite to send authenticated HTTP requests with modified commerceOrderId parameters and observe if shipment addresses from other virtual instances are returned. For example, a curl command might look like: curl -b cookies.txt 'https://your-liferay-instance.com/path?_com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId=some_id' -v and then modify the commerceOrderId to test access to other instances' data. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Liferay DXP to a fixed version where this vulnerability is resolved. The fix is included in Liferay Portal 7.4.3.112, Liferay DXP 2024.Q1.1, and Liferay DXP 2023.Q4.6. Until the upgrade can be applied, restrict access to the affected portlet and monitor authenticated user activities to detect any unauthorized access attempts. [1]